Illinois Supreme Court Opens Floodgates for Biometric Lawsuits: Will the Business Community Lobby for Change?

Monday, February 4, 2019

The Illinois Supreme Court issued its long-awaited ruling in Rosenbach and reversed the appellate court’s decision that technical violations of the Illinois Biometric Information Privacy Act (“BIPA” or “Act”) without “some actual injury or harm” are not actionable:

Contrary to the appellate court’s view, an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an “aggrieved” person and be entitled to seek liquidated damages and injunctive relief pursuant to the Act.

Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 40.

With this ruling, the Illinois Supreme Court has likely unleashed another wave of class action litigation. These class actions could transfer millions of dollars from companies that do business in Illinois into the pockets of the plaintiffs’ class action bar. While no one can dispute BIPA’s good intentions, biometric technology has evolved far beyond 2008, when the law was enacted. The biometric equipment in use today transforms the biometric identifier into an encrypted mathematical algorithm that renders it unreadable and unidentifiable. These safeguards prevent the harms contemplated by BIPA. In Rivera Judge Edmond Chang explained that laws such as BIPA (with their statutory damages and fee-shifting) are an imperfect fit and cannot keep pace with technological advances: “The difficulty in predicting technological advances and their legal effects is one reason why legislative pronouncements with minimum statutory damages and fee-shifting might reasonably be considered a too-blunt instrument for dealing with technology.” Rivera, 162018 WL 6830332, fn. 20 (N.D. Ill. Dec. 29, 2018).

Rosenbach is not a positive development for Illinois’ business economy, especially when no BIPA lawsuit has pled any unauthorized disclosure of biometric data to the public, any illegal hacking, or other actual injury. Unless the Illinois legislature promptly amends BIPA, these BIPA class actions have the potential to bankrupt some Illinois businesses and discourage future business investment in Illinois.

BIPA’s History and Key Provisions

In 2008, Illinois became the first state to regulate a private entity’s collection, use, storage, transmission, and destruction of “biometric identifiers” such as retina or iris scans, fingerprints, voiceprints, or hand or facial geometry scans. BIPA also protects “biometric information,” which includes “any information . . . based on an individual’s biometric identifier used to identify an individual.”

Section 15 of BIPA prohibits a private entity from collecting a person’s or customer’s “biometric identifier” or “biometric information” unless it first informs them of the “specific purpose and length of term for which [it] is being collected, stored and used” and obtains their executed release or consent. Section 15 also requires private entities to develop a written policy that establishes a retention schedule and guidelines for the timely destruction of biometric data in compliance with BIPA.

Section 20 gives any “person aggrieved” by a violation of the Act a private “right of action” to sue for statutory damages of $1,000 per negligent violation, $5,000 per intentional violation, actual damages (if greater than the statutory damages), injunctive relief, attorney’s fees and costs.

Class Actions and ​Rosenbach

The consumer class actions began in 2015. The employer class actions followed two years later in 2017, nine years after BIPA’s enactment. Rosenbach is a putative consumer class action. Stacy Rosenbach, as mother and next friend of Alexander Rosenbach, filed suit against Six Flags after her son visited the amusement park on a school field trip. Ms. Rosenbach learned that Six Flags scanned her son’s thumbprint to allow him access to the amusement park on a season pass. The lawsuit did not allege any actual harm to her son. It alleged that Six Flags failed to inform Alexander or his mother of the specific purpose and length of term for which his fingerprint had been collected, and failed to obtain his written consent or hers prior to collecting it.

When Six Flags’ initial motion to dismiss was denied, the amusement park sought interlocutory review of the denial. On appeal, the appellate court sided with Six Flags and held that plaintiff must allege some actual harm—not just a violation of the Act—to be a “person aggrieved by a violation of this Act.” If every technical violation of BIPA was actionable, it would render “superfluous” the requirement that a person be “aggrieved by a violation of this Act.” Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2d) 170317, ¶ 23.

The Illinois Supreme Court rejected the appellate court’s ruling that actual injury is a prerequisite to the recovery of statutory damages under BIPA. It said this was “antithetical to the Act’s preventative and deterrent purposes” and held that a violation of BIPA’s notice and consent provisions was a “real and significant” injury:

When a private entity fails to adhere to the statutory procedures, as defendants are alleged to have done here, “the right of the individual to maintain [his or] her biometric privacy vanishes into thin air. The precise harm the Illinois legislature sought to prevent is then realized.” This is no mere “technicality.” The injury is real and significant.

[T]he legislative intent was not to put companies out of business but to keep companies in compliance with the law.

Id., July 12, 2016 Tr. of Proceedings, pp. 17:21-18:3.

The Fair and Accurate Credit Transactions Act of 2003 (“FACTA”) is an excellent example of how the business community united when hit with a plethora of seven-figure class actions based on technical violations and no actual injury. In the FACTA cases, class action attorneys sued retailers under FACTA for not having coordinated with their credit card vendors to ensure that sales receipts redacted both a customer’s credit card number and the expiration date. Because of a grammatical misinterpretation of the statute, most businesses redacted one but not the other. The business community responded in a communal uproar, contacted their legislators, and were successful in getting FACTA amended. Here, the Illinois Supreme Court may be construing BIPA in a manner that the Illinois legislature did not intend or foresee in 2008—just as many courts misread FACTA contrary to Congress’ intent.

Given the Rosenbach ruling, Illinois companies and those who do business in Illinois will want to lobby the Illinois legislature to amend BIPA. For example, biometric data is not covered by a number of analogous data breach notification laws if it is encrypted or otherwise altered such that the data is unreadable. In many BIPA cases, the biometric scanner transformed the finger scan into an encrypted mathematical algorithm that is unreadable and unidentifiable. Crippling liability for mere technical violations could not be what the legislature intended.

This “call to action” also applies to companies currently in compliance with BIPA. Companies may want to periodically audit their compliance at each facility or store in Illinois, as the slightest misstep could result in class actions, despite years of compliance.

Ms. Rahimi’s experience includes extensive motion practice, representation at settlement conferences and issuing and responding to oral and written discovery. In addition to courtroom litigation, Ms. Rahimi has represented management in administrative agency investigations, fact-finding conferences, mediations and hearings.

Prior to joining Ogletree Deakins, Ms. Rahimi practiced at a national litigation firm, where she represented employers in federal and state litigation involving matters of employment discrimination and unlawful termination, breaches of non-competition agreements, and wage and hour compliance.

While in law school, Ms. Rahimi was the Vice President and President of Phi Alpha Delta, the nation’s largest legal fraternity. She also served as a Teaching Assistant for DePaul’s Legal Analysis, Research, and Communication courses.

Before embarking on her legal career, Ms. Rahimi worked in the Development and Fundraising departments of the Chicago Children’s Theatre and the Goodman Theatre before serving as the Director of Development for the State Theatre of Chicago. In addition, she received a number of awards for her theatrical works, including the Dennis McIntyre Prize for Distinction in Undergraduate Playwriting.

Legal Disclaimer

You are responsible for reading, understanding and agreeing to the National Law Review's (NLR’s) and the National Law Forum LLC's Terms of Use and Privacy Policy before using the National Law Review website. The National Law Review is a free to use, no-log in database of legal and business articles. The content and links on www.NatLawReview.com are intended for general information purposes only. Any legal analysis, legislative updates or other content and links should not be construed as legal or professional advice or a substitute for such advice. No attorney-client or confidential relationship is formed by the transmission of information between you and the National Law Review website or any of the law firms, attorneys or other professionals or organizations who include content on the National Law Review website. If you require legal or professional advice, kindly contact an attorney or other suitable professional advisor.

Some states have laws and ethical rules regarding solicitation and advertisement practices by attorneys and/or other professionals. The National Law Review is not a law firm nor is www.NatLawReview.com intended to be a referral service for attorneys and/or other professionals. The NLR does not wish, nor does it intend, to solicit the business of anyone or to refer anyone to an attorney or other professional. NLR does not answer legal questions nor will we refer you to an attorney or other professional if you request such information from us.

Under certain state laws the following statements may be required on this website and we have included them in order to be in full compliance with these rules. The choice of a lawyer or other professional is an important decision and should not be based solely upon advertisements. Attorney Advertising Notice: Prior results do not guarantee a similar outcome. Statement in compliance with Texas Rules of Professional Conduct. Unless otherwise noted, attorneys are not certified by the Texas Board of Legal Specialization, nor can NLR attest to the accuracy of any notation of Legal Specialization or other Professional Credentials.

The National Law Review - National Law Forum LLC 4700 Gilbert Ave. Suite 47 #230 Western Springs, IL 60558 Telephone (708) 357-3317 If you would ike to contact us via email please click here.